CloudPanel comes with clpctl, a command-line tool for tasks you'd otherwise do in the browser. Run it as root.
See every available command
Code:
clpctl list
This prints all commands grouped by area (sites, databases, Let's Encrypt, users, and so on). Add --help to any command to see its options, for example:
Code:
clpctl site:add:php --help
Why use it
Automation: create sites, databases and certificates from scripts when setting up many servers.
Recovery: reset an admin password or fix things when the web interface isn't reachable.
Repeatability: the same command gives the same result every time.
Before you run anything destructive
Take a backup or snapshot first, and test commands on a staging server.
If you've built useful clpctl scripts, share them in this thread.
HestiaCP (Hestia Control Panel) is a free, open-source hosting panel licensed under GPLv3. It started as a fork of VestaCP and is now actively maintained, while VestaCP itself has been largely abandoned. If you still run VestaCP, Hestia is the natural place to move to.
Main features
Web: Nginx, optionally with Apache behind it, and multiple PHP-FPM versions per site.
Mail: Exim and Dovecot, with webmail, SPF/DKIM support and spam filtering.
DNS: BIND, so the server can host your zones (and act as a DNS cluster).
Free SSL with Let's Encrypt for sites, mail and the panel.
Users and packages for hosting clients, plus backups and a file manager.
A full command-line toolkit: every panel action has a matching v-* command.
Everything you can do in the HestiaCP web interface has a matching command. They live in /usr/local/hestia/bin and are run as root. A few that come up all the time:
What can you host on CloudPanel? PHP, Node.js, Python, static sites and reverse proxies
CloudPanel is a free control panel built on Nginx, but it isn't only for PHP. When you add a site it offers six site types, and each one gets its own Linux site user and a ready-made Nginx configuration. This guide explains what each type is for and what you'll be asked when you create it, so you can pick the right one first time.
1. WordPress Use it for: blogs, business sites and WooCommerce shops.
CloudPanel creates the site user, the database and a fully configured WordPress install in one step, with no setup wizard. It pairs well with CloudPanel's built-in Varnish Cache.
Step by step: How to install WordPress in CloudPanel.
2. PHP application Use it for: any PHP code: Laravel, Symfony, Magento, Drupal, Joomla, Shopware, PrestaShop, Nextcloud, Moodle, TYPO3 and more. You choose: the Application (Generic or a framework template that sets the right rewrite rules), the domain and the PHP version (7.1 to 8.5, changeable later).
Step by step: How to create a PHP site in CloudPanel.
3. Node.js app Use it for: Node.js apps and APIs, for example Ghost or Strapi. You choose: the domain, the Node.js version (LTS versions from 12 to 24) and the App Port your app listens on. Nginx serves the domain and passes requests to that port. Keeping it running: CloudPanel's docs use pm2 as the process manager:
To restart it after a reboot, add a cron job for the site user with
Code:
@reboot pm2 resurrect
(and set PATH in that crontab so Node is found).
4. Python app Use it for: Django, Flask, FastAPI and other Python web apps. You choose: the domain, the Python version (3.12 on Ubuntu 22.04/24.04 and Debian 12; 3.14 on Ubuntu 26.04 and Debian 13) and the App Port. CloudPanel's docs cover running Python apps with uWSGI.
5. Static HTML site Use it for: plain HTML/CSS/JavaScript sites, landing pages and the built output of static site generators (Hugo, Jekyll, Astro, a React or Vue build). You choose: just the domain. Upload your files to the site's htdocs folder and Nginx serves them directly. It's the fastest and simplest option.
6. Reverse proxy Use it for: anything else running on the server or another machine: a Docker container, a Go or Java app, Uptime Kuma, n8n, a self-hosted tool on another port. You choose: the domain, the Reverse Proxy URL (for example
Code:
http://127.0.0.1:3001
) and a site user. CloudPanel handles the domain and free SSL, and forwards traffic to that URL.
This is also how you run Docker apps with CloudPanel, since it has no built-in Docker manager.
Which type should I choose?
WordPress site? Use WordPress, not PHP. You get a ready install in one step.
PHP framework or shop? Use PHP with the matching application template.
App that runs its own server process (Node.js, Python)? Use Node.js or Python with the app's port.
Only files, no server code? Use Static HTML.
Docker container or any other service? Use Reverse proxy.
Good to know
Every site type gets its own site user, so sites are isolated from each other.
I'm moving about 15 sites (mostly WordPress) from an old server to a new one running FASTPANEL. What's the least painful way to do it without downtime?
The approach that usually works best:
1. Lower DNS TTL to around 300 seconds a day before the move, so the switch spreads quickly.
2. Create each site and database in FASTPANEL first, with the same domain name and PHP version as before.
3. Copy files with rsync over SSH (fast, resumable, keeps permissions):
CyberPanel is a free, open-source hosting control panel built around OpenLiteSpeed, the open-source edition of the LiteSpeed web server. It can also run LiteSpeed Enterprise if you have a licence. Its big selling point is speed, especially for WordPress, thanks to LiteSpeed's built-in page cache (LSCache).
Main features
Websites: add domains and child domains, choose PHP (LSPHP) versions, one-click WordPress with LSCache.
Free SSL: Let's Encrypt for sites, mail and the panel itself.
Email: Postfix and Dovecot, webmail, and DKIM.
DNS: built-in PowerDNS, so the server can host its own zones.
Databases, FTP, file manager, backups, plus a Docker manager and a firewall.
Multi-user: packages and reseller accounts if you host for clients.
New CyberPanel install, email works, but almost everything I send lands in the recipient's spam folder (Gmail and Outlook both). What do I need to set up?
Short answer for anyone finding this later: deliverability depends mostly on DNS and your server's reputation, not the panel. Check these in order:
SPF: a TXT record on your domain listing who may send mail for it, e.g. v=spf1 a mx ip4:YOUR.SERVER.IP ~all
DKIM: generate a key in CyberPanel (Email, DKIM Manager) and add the TXT record it shows to your DNS.
DMARC: start with a monitoring policy, e.g. a TXT record at _dmarc.example.com with v=DMARC1; p=none; rua=mailto:[email protected]
Reverse DNS (PTR): set it at your VPS provider so your server IP resolves back to your mail hostname (e.g. mail.example.com). Many providers block port 25 or PTR changes until you ask support.
Hostname: the server hostname should match the PTR and have an A record.
Blacklists: check your IP on a blacklist lookup site. A recycled VPS IP may already be listed.
Then send a test to a mail-testing service to see a score and exactly what's missing. Post your results here if you're still stuck (hide your real domain if you prefer).
FASTPANEL is a free hosting control panel developed by the team behind the FASTVPS hosting company. It's aimed at people who host several websites on their own server and want a clean, modern interface without paying for a licence.
Main features
Web stack: Nginx in front, with Apache or PHP-FPM behind it, and several PHP versions you can pick per site.
Site isolation: each site can run under its own system user, which limits the damage if one site is hacked.
Free SSL with Let's Encrypt.
Databases, FTP/SFTP users, file manager, cron and backups.
Mail and DNS management.
Multi-user: give clients or developers access to only their own sites.
Good to know
Install it on a clean, supported Linux distribution (Debian and Ubuntu are the usual choices). Check the official site for the current list.
The free licence needs a quick registration during setup.
After installation the panel is reached in the browser on its own port; the installer prints the address and login.
FASTPANEL is a good fit if you want something simpler than cPanel-style panels, with per-site users and multiple PHP versions built in.
What is aaPanel?
aaPanel is a browser-based control panel for Linux servers. It helps you manage websites, PHP, databases, certificates, files and backups from one dashboard. Its core is free, while Pro features and some plugins or services may cost extra. You still need to pay for your server and domain.
Review status: Official documentation reviewed 9 October 2026. This introduction is not a hands-on benchmark or a claim that a specific release has been tested. Original VPS walkthroughs and screenshots are pending.
What can it manage?
Website domains, document roots, PHP selection, rewrites and redirects.
Web-server and database software through the supported panel workflow.
Website certificates, file management and scheduled jobs.
Website/database backups and supported remote-storage integrations.
Available features depend on the edition, plugins and installed versions. Check compatibility and licensing before relying on a feature. Installing a panel does not replace Linux administration, updates or a recovery plan.
Before installing
Use a clean supported Linux server and check the current OS/architecture requirements in aaPanel Quick Start. Do not install it over another hosting panel or an existing production stack without a supported migration plan. Size RAM, CPU and disk for your application, database, backups and traffic; an installation minimum is not a production capacity guarantee.
The installer prints a management URL, entrance path and credentials. Store these privately. The trusted server console can display the current panel details with:
Code:
bt default
That output is sensitive: do not post it in the forum or include it in a public screenshot. Running bt opens the panel maintenance menu; read each option before using it.
Common questions Does aaPanel provide the VPS itself?
No. The panel is software installed on a server you obtain separately.
Are all features free?
No. Check the current edition and individual plugin/service terms. A free core does not mean every add-on is included.
Does every SSL certificate renew automatically?
No. Renewal depends on the validation method, credentials and scheduled jobs. aaPanel documents that manual DNS TXT validation does not provide automatic renewal. Monitor expiry and verify your chosen renewal process.
Can it serve unrelated hosting customers?
Evaluate the intended permissions, isolation, limits and recovery workflow before choosing it for customer hosting. A sub-account alone is not proof of isolation.
Official references:Quick Start; Website and SSL management. For help, share your OS, aaPanel release, web server and a redacted error, not credentials.
How do you secure aaPanel after installation?
Restrict management access, use trusted HTTPS and strong authentication, keep the panel and software updated, and prove an off-site backup restore. Test a new login after each access change while keeping SSH and the provider console available.
Scope and review: Documentation reviewed 9 October 2026. Menu names depend on the aaPanel release. Fresh-VPS testing and screenshots are pending; no exact release is claimed as tested. Record your OS and panel version before following this checklist.
1. Confirm recovery before changing access
Check that the provider console and a fresh SSH login work. Save current settings and the actual panel port privately. Keep the installation-generated entrance path confidential. It reduces casual discovery but is not a replacement for authentication or a firewall.
Changing the panel port is optional. If you do change it, permit the new port in both firewall layers first, test it, then remove the old rule when appropriate.
2. Use strong authentication
Replace initial credentials with a unique password and enable the supported authenticator/2FA feature. Store recovery information privately and test a fresh session before closing the original. Disable unused API access; protect and limit any credentials you need.
3. Verify trusted panel HTTPS
Panel SSL is separate from website SSL. Use a certificate matching your management hostname and verify its chain and renewal process. A self-signed certificate needs an independently verified trust procedure; an unexplained browser warning is not proof of the correct server. Avoid plain HTTP for panel credentials.
If binding a management domain, prove DNS and HTTPS first. Domain binding can change which URL allows access, so keep a recovery path.
4. Restrict management traffic
Allow the actual management port only from your fixed IP or VPN where practical, using both provider and guest firewall rules. Check how IPv6 is handled. If your IP changes, update the allowlist through the trusted recovery path. Do not disable the whole firewall to fix one rule.
A basic public website needs its web ports; the panel, databases and caches should not be broadly exposed. Open mail or FTP ports only when deliberately deploying those services.
5. Verify SSH-key access before disabling passwords
Create and test a named administrator with keys and sudo first. Validate SSH configuration, inspect effective settings and test a new connection before removing the old access method. Follow the VPS access and firewall checklist for Ubuntu/Debian examples; adapt it to your OS and MFA requirements.
6. Maintain updates and recoverable backups
Use supported panel/plugin/runtime updates and check OS-update compatibility. Schedule website and application-consistent database backups, store a copy outside the VPS, and test restoration into an isolated destination. Monitor backup age, disk space, failed jobs and certificate expiry.
Verify before calling it finished
A fresh trusted panel login and your intended 2FA flow work.
Management access is limited as intended over IPv4 and IPv6.
SSH and the provider recovery console remain available.
Renewal, update and backup jobs are monitored.
An off-site restore has been checked.
Locked out? Check the actual port, current source IP, bound hostname and entrance path through the trusted console. Use the documented bt maintenance menu only after identifying the cause; do not remove protections indiscriminately.
